The default event ... log. It provides detailed information about process creations, network connections, and changes to file creation time. You can tweak Sysmon as noted in the Sysmon cheat sheet ...